[fm-var] Define source-access and query-resource policy

[DandyLyons]

Problem / outcome

Define and implement md-utils' host policy for source access and RFC 9535 query-resource limits so valid Rev 3 references are evaluated only within explicitly supported, authorized, and bounded capabilities.

Epic: #111. Milestone: 2 — Resolution and scalar evaluation.

In scope

• Decide/document initial supported schemes/resources, at minimum same-document and local file-backed Markdown/YAML.
• Establish base URI, allowed-root, dot-segment, symlink, encoding, byte-size, and content-kind rules.
• Define behavior for absolute paths, file: URIs, network schemes, credentials, redirects, URI queries, and paths escaping the selected content root.
• Define host defaults/configuration for JSONPath query length, nesting/recursion, execution work/time, result count, and regular-expression work.
• Implement source-access, unsupported-query-capability, and query-resource diagnostics without changing portable URI/JSONPath validity.
• Make policy inputs explicit, deterministic, and automation-safe for single-file and directory workflows.

Relevant specification sections

• §3.4 source references and host resolution.
• §3.7 source/query-resource failures retain caches.
• §4.1 query capabilities.
• §9 host security and query-resource responsibilities.

Dependencies and blockers

• Blocked by [fm-var] Resolve RFC 3986 sources and project YAML query arguments #112's resource-provider boundary and [fm-var] Implement RFC 9535 JSONPath querying #124's portable limit/error interface.
• Policy decisions must be settled before exposing write synchronization.

Implementation considerations

• Implement authorization/configuration in MarkdownUtilities/CLI, not as filesystem/network access in Core.
• Canonicalize local paths and resolve symlinks before allowed-root checks; do not rely on string-prefix containment.
• Do not implicitly enable network access, credentials, redirects, or non-standard JSONPath functions.
• Bound bytes, YAML parsing, JSONPath evaluation, results, and regex work for untrusted documents; never evaluate filters via a general-purpose runtime.
• Redact credentials and unintended contents from diagnostics.

Acceptance Criteria

• Supported schemes/resources and default query limits are explicitly documented.
• A host-provided base/allowed root governs local relative, absolute-path, and file: access consistently.
• Traversal/symlink escapes and unsupported/denied/unreadable/excessive sources receive distinct stable codes.
• Unsupported function extensions and each query-resource limit are distinct from malformed/invalid query syntax.
• Denials/limits never mutate caches and never become portable syntax errors.
• Network access, credentials, redirects, and extra query functions remain disabled unless explicitly reviewed and enabled.
• Diagnostics avoid leaking credentials or unintended source/query-result contents.

Test requirements

• Isolated filesystem tests for in-root access, escapes, missing/unreadable files, size/UTF-8 limits, and unsupported schemes.
• Deterministic tests for every query limit, unavailable extension, adversarial regex, and redaction behavior.
• CLI tests across single files and content-tree scans.

Documentation / CLI-help impact

• Security/help documentation for base/root selection, supported schemes, refusal behavior, query capability, and limit configuration/defaults.

Explicitly deferred

• Browser CORS, general remote access/authentication, redirects/caching, editor-vault policy, and non-standard query functions not accepted by host policy.